The file was public for weeks before anyone noticed. It held names, emails, account numbers. Private data drained out through a misconfigured Amazon S3 read-only role. No alarms went off. No one had permission to delete the object. And that’s the trap.
Preventing Personally Identifiable Information (PII) leakage from AWS S3 buckets is not only about restricting write access. Read-only roles can cause the same damage. If a role can list and get objects from a bucket that contains PII, the exposure risk is total. You must build defenses that assume every granted read path will be used.
Audit every AWS Identity and Access Management (IAM) policy tied to S3. Search for s3:GetObject and s3:ListBucket permissions. Map those roles to the buckets they touch. Identify where PII might be stored — often it hides in logs, exports, or backups. Remove read access to any bucket holding sensitive data unless that exact access is required for operations.
Enable Amazon S3 Block Public Access at both the account and bucket level. This closes accidental exposure routes through ACLs or bucket policies. Use AWS Config rules or Security Hub to enforce compliance.